def createFields(self):
yield RawBytes(self, "marker", len(self.MAGIC))
yield WhiteSpace(self, "sep[]")
yield String(self, "start_attribute_marker", 2)
addr = self.absolute_address + self.current_size
while self.stream.readBytes(addr, 2) != b'>>':
yield WhiteSpace(self, "sep[]")
t = PDFName(self, "type[]")
yield t
name = t.value.decode()
self.info("Parsing PDFName '%s'" % name)
if name == "Size":
yield PDFNumber(self, "size",
"Entries in the file cross-reference section")
elif name == "Prev":
yield PDFNumber(self, "offset")
elif name == "Root":
yield Catalog(self, "object_catalog")
elif name == "Info":
yield Catalog(self, "info")
elif name == "ID":
yield PDFArray(self, "id")
elif name == "Encrypt":
yield PDFDictionary(self, "decrypt")
else:
raise ParserError("Don't know trailer type '%s'" % name)
addr = self.absolute_address + self.current_size
yield String(self, "end_attribute_marker", 2)
yield LineEnd(self, "line_end[]")
yield String(self, "start_xref", 9)
yield LineEnd(self, "line_end[]")
yield PDFNumber(self, "cross_ref_table_start_address")
yield LineEnd(self, "line_end[]")
yield String(self, "end_marker", len(ENDMAGIC))
yield LineEnd(self, "line_end[]")
def createFields(self):
yield String(self, "signature", 17, "XM signature", charset="ASCII")
yield String(self, "title", 20, "XM title", charset="ASCII", strip=' ')
yield UInt8(self, "marker", "Marker (0x1A)")
yield String(self,
"tracker_name",
20,
"XM tracker name",
charset="ASCII",
strip=' ')
yield UInt8(self, "format_minor")
yield UInt8(self, "format_major")
yield filesizeHandler(UInt32(self, "header_size", "Header size (276)"))
yield UInt16(self, "song_length", "Length in patten order table")
yield UInt16(self, "restart", "Restart position")
yield UInt16(self, "channels",
"Number of channels (2,4,6,8,10,...,32)")
yield UInt16(self, "patterns", "Number of patterns (max 256)")
yield UInt16(self, "instruments", "Number of instruments (max 128)")
yield Bit(self, "amiga_ftable", "Amiga frequency table")
yield Bit(self, "linear_ftable", "Linear frequency table")
yield Bits(self, "unused", 14)
yield UInt16(self, "tempo", "Default tempo")
yield UInt16(self, "bpm", "Default BPM")
yield GenericVector(self, "pattern_order", 256, UInt8, "order")
def createFields(self):
addr = self.absolute_address
len = self.stream.searchBytesLength(b':', False, addr,
addr + (MAX_STRING_LENGTH + 1) * 8)
if len is None:
raise ParserError("Torrent: unable to find string separator (':')")
if not len:
raise ParserError("Torrent: error: no string length!")
val = String(self, "length", len, "String length")
yield val
try:
len = int(val.value)
except ValueError:
len = -1
if len < 0:
raise ParserError("Invalid string length (%s)" %
makePrintable(val.value, "ASCII"))
yield String(self, "separator", 1, "String length/value separator")
if not len:
self.info("Empty string: len=%i" % len)
return
if len < 512:
yield String(self,
"value",
len,
"String value",
charset="ISO-8859-1")
else:
# Probably raw data
yield RawBytes(self, "value", len, "Raw data")
def createFields(self):
yield Bits(self, "version", 4)
yield Bits(self, "instance", 12)
yield Enum(UInt16(self, "type"), PowerPointDocument.OBJ_TYPES)
yield UInt32(self, "length")
self._size = self["length"].value * 8 + 64
obj_type = self["type"].display
obj_len = self["length"].value
# type 1064 (RoundTripCustomTableStyles12) may appear to be a
# container, but it is not.
if self["version"].value == 0xF and self["type"].value != 1064:
while (self.current_size) // 8 < obj_len + 8:
yield PowerPointDocument.PowerPointObject(self, "object[]")
elif obj_len:
if obj_type == "FontEntityAtom":
yield String(self,
"data",
obj_len,
charset="UTF-16-LE",
truncate="\0",
strip="\0")
elif obj_type == "TextCharsAtom":
yield String(self, "data", obj_len, charset="UTF-16-LE")
elif obj_type == "TextBytesAtom":
yield String(self, "data", obj_len, charset="ASCII")
elif hasattr(PowerPointDocument, obj_type):
field = getattr(PowerPointDocument, obj_type)(self, "data")
field._size = obj_len * 8
yield field
else:
yield RawBytes(self, "data", obj_len)
def createFields(self):
# Header
yield String(self, "magic", 3, "File magic code", charset="ASCII")
yield String(self, "version", 3, "GIF version", charset="ASCII")
yield ScreenDescriptor(self, "screen")
if self["screen/global_map"].value:
bpp = (self["screen/size_global_map"].value + 1)
yield PaletteRGB(self, "color_map", 1 << bpp, "Color map")
self.color_map = self["color_map"]
else:
self.color_map = None
self.images = []
while True:
code = Enum(Character(self, "separator[]", "Separator code"),
self.separator_name)
yield code
code = code.value
if code == "!":
yield Extension(self, "extensions[]")
elif code == ",":
yield Image(self, "image[]")
elif code == ";":
# GIF Terminator
break
else:
raise ParserError("Wrong GIF image separator: 0x%02X" %
ord(code))
def createFields(self):
yield String(self,
"signature",
4,
"AVI header (RIFF)",
charset="ASCII")
yield filesizeHandler(UInt32(self, "filesize", "File size"))
yield String(self,
"type",
4,
"Content type (\"AVI \", \"WAVE\", ...)",
charset="ASCII")
# Choose chunk type depending on file type
try:
chunk_cls = self.VALID_TYPES[self["type"].value][0]
except KeyError:
chunk_cls = Chunk
# Parse all chunks up to filesize
while self.current_size < self["filesize"].value * 8 + 8:
yield chunk_cls(self, "chunk[]")
if not self.eof:
yield RawBytes(self, "padding[]",
(self.size - self.current_size) // 8)
def createFields(self):
size = self._size // 8
# TODO: Strings charset?
if self.stream.readBytes(self.absolute_address, 9) == b"PeakValue":
yield String(self, "text", 9, "Text")
size -= 9
yield String(self, "content", size, "Content")
def createFields(self):
yield String(self, "name", 20, strip='\0')
yield GenericVector(self, "samples", 31, SampleInfo, "info")
yield UInt8(self, "length")
yield UInt8(self, "played_patterns_count")
yield GenericVector(self, "patterns", 128, UInt8, "position")
yield String(self, "type", 4)
def createFields(self):
while self.stream.readBytes(self.absolute_address + self.current_size,
1) == b'%':
size = getLineEnd(self, 4)
if size == 2:
yield String(self, "crc32_comment", 1)
yield textHandler(UInt16(self, "crc32"), hexadecimal)
elif size == 4:
yield String(self, "crc32_comment", 1)
yield textHandler(UInt32(self, "crc32"), hexadecimal)
elif self.stream.readBytes(
self.absolute_address + self.current_size, size).isalpha():
yield String(self, "comment[]", size)
else:
RawBytes(self, "unknown_data[]", size)
yield LineEnd(self, "line_end[]")
# abs_offset = self.current_size//8
# TODO: yield objects that read offsets and deduce size from
# "/cross_ref_table/sub_section[]/entries/item[]"
offsets = []
for subsection in self.array("/cross_ref_table/sub_section"):
for obj in subsection.array("entries/item"):
if "byte_offset" in obj:
# Could be inserted already sorted
offsets.append(obj["byte_offset"].value)
offsets.append(self["/cross_ref_table"].absolute_address // 8)
offsets.sort()
for index in range(len(offsets) - 1):
yield Catalog(self,
"object[]",
size=offsets[index + 1] - offsets[index])
def createFields(self):
yield String(self, "header_id", 4, "DataBase Header Markup (\"mhbd\")", charset="ISO-8859-1")
yield UInt32(self, "header_length", "Header Length")
yield UInt32(self, "entry_length", "Entry Length")
yield UInt32(self, "unknown[]")
yield UInt32(self, "version_number", "Version Number")
yield UInt32(self, "child_number", "Number of Children")
yield UInt64(self, "id", "ID for this database")
yield UInt16(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield UInt64(self, "unknown[]")
yield UInt16(self, "unknown[]")
yield UInt16(self, "hashing_scheme[]", "Algorithm used to calculate the database hash")
yield NullBytes(self, "unknown[]", 20)
yield String(self, "language_id", 2, "Language ID")
yield UInt64(self, "persistent_id", "Library Persistent ID")
yield UInt32(self, "unknown[]")
yield UInt32(self, "unknown[]")
yield RawBytes(self, "hash[]", 20)
yield Int32(self, "timezone_offset[]", "Timezone offset in seconds")
yield UInt16(self, "unknown[]")
yield RawBytes(self, "iphone_hash[]", 45)
size = self["header_length"].value - self.current_size / 8
if size > 0:
yield NullBytes(self, "padding", size)
for i in range(self["child_number"].value):
yield DataSet(self, "dataset[]")
padding = self.seekByte(self["entry_length"].value, "entry padding")
if padding:
yield padding
def createFields(self):
yield self.getType()
yield String(self, "filename", 12, strip='\0')
yield from self.getInstrumentFields()
yield String(self, "name", 28, strip='\0')
yield String(self, "marker", 4, "Either 'SCRS' or '(empty)'", strip='\0')
def createFields(self):
yield String(self, "dict_start", 2)
while not self.eof:
addr = self.absolute_address + self.current_size
if self.stream.readBytes(addr, 2) != b'>>':
yield from parsePDFType(self)
else:
break
yield String(self, "dict_end", 2)
def __init__(self, parent, name):
n = 0
while 1:
ch = parent.stream.readBytes(
parent.absolute_address + parent.current_size + n * 8, 1)
if not ch.isspace():
break
n += 1
String.__init__(self, parent, name, n)
def createFields(self):
yield Enum(UInt8(self, "charset"), self.charset_desc)
yield String(self, "lang", 3, "Language", charset="ASCII")
charset = getCharset(self["charset"])
yield CString(self, "title", "Title", charset=charset, strip=self.STRIP)
size = (self.size - self.current_size) // 8
if not size:
return
yield String(self, "text", size, "Text", charset=charset, strip=self.STRIP)
def createFields(self):
yield String(self, "marker", 5, MAGIC)
length = getLineEnd(self, 4)
if length is not None:
# self.info("Found at position %08X" % len)
yield String(self, "version", length - 1)
yield LineEnd(self, "line_end")
else:
self.warning("Can't determine version!")
def createFields(self):
yield String(self,
"start",
1,
"Dictionary start delimiter (d)",
charset="ASCII")
while self.stream.readBytes(self.absolute_address + self.current_size,
1) != b"e":
yield DictionaryItem(self, "item[]")
yield String(self, "end", 1, "Dictionary end delimiter")
def createFields(self):
yield String(self, "signature", 4, "Signature (FORM)", charset="ASCII")
yield filesizeHandler(UInt32(self, "filesize"))
yield String(self,
"type",
4,
"Form type (AIFF or AIFC)",
charset="ASCII")
while not self.eof:
yield Chunk(self, "chunk[]")
def __init__(self,
parent,
name,
nbytes,
description=None,
strip=' \0',
charset='ISO-8859-1',
*args,
**kwargs):
String.__init__(self, parent, name, nbytes, description, strip,
charset, *args, **kwargs)
def createFields(self):
yield Bytes(self, "jmp", 3,
"Jump instruction (to skip over header on boot)")
yield String(self,
"oem_name",
8,
"OEM Name (padded with spaces)",
charset="ASCII")
yield UInt16(self, "sector_size", "Bytes per sector")
yield UInt8(self, "cluster_size", "Sectors per cluster")
yield UInt16(self, "reserved_sectors",
"Reserved sector count (including boot sector)")
yield UInt8(self, "fat_nb", "Number of file allocation tables")
yield UInt16(self, "max_root",
"Maximum number of root directory entries")
yield UInt16(self, "sectors1",
"Total sectors (if zero, use 'sectors2')")
yield UInt8(self, "media_desc", "Media descriptor")
yield UInt16(self, "fat_size", "Sectors per FAT")
yield UInt16(self, "track_size", "Sectors per track")
yield UInt16(self, "head_nb", "Number of heads")
yield UInt32(self, "hidden", "Hidden sectors")
yield UInt32(self, "sectors2", "Total sectors (if greater than 65535)")
if self.parent.version == 32:
yield UInt32(self, "fat32_size", "Sectors per FAT")
yield UInt16(self, "fat_flags", "FAT Flags")
yield UInt16(self, "version", "Version")
yield UInt32(self, "root_start",
"Cluster number of root directory start")
yield UInt16(self, "inf_sector",
"Sector number of FS Information Sector")
yield UInt16(self, "boot_copy",
"Sector number of a copy of this boot sector")
yield NullBytes(self, "reserved[]", 12, "Reserved")
yield UInt8(self, "phys_drv", "Physical drive number")
yield NullBytes(self, "reserved[]", 1, 'Reserved ("current head")')
yield UInt8(self, "sign", "Signature")
yield textHandler(UInt32(self, "serial", "ID (serial number)"),
hexadecimal)
yield String(self,
"label",
11,
"Volume Label",
strip=' ',
charset="ASCII")
yield String(self,
"fs_type",
8,
"FAT file system type",
strip=' ',
charset="ASCII")
yield Bytes(self, "code", 510 - self.current_size // 8,
"Operating system boot code")
yield Bytes(self, "trail_sig", 2, "Signature (0x55 0xAA)")
def createFields(self):
yield Enum(UInt16(self, "type"), self.type_name)
yield UInt16(self, "name_len", "Name length in character (byte=len*2)")
if self["name_len"].value:
yield String(self, "name", self["name_len"].value * 2, "Name", charset="UTF-16-LE", strip=" \0")
yield UInt16(self, "desc_len", "Description length in character (byte=len*2)")
if self["desc_len"].value:
yield String(self, "desc", self["desc_len"].value * 2, "Description", charset="UTF-16-LE", strip=" \0")
yield UInt16(self, "info_len")
if self["info_len"].value:
yield RawBytes(self, "info", self["info_len"].value)
def createFields(self):
yield textHandler(UInt32(self, "plugin_id1"), hexadecimal)
yield textHandler(UInt32(self, "plugin_id2"), hexadecimal)
yield UInt32(self, "input_routing")
yield UInt32(self, "output_routing")
yield GenericVector(self, "routing_info", 4, UInt32, "reserved")
yield String(self, "name", 32, strip='\0')
yield String(self,
"dll_name",
64,
desc="Original DLL name",
strip='\0')
def createFields(self):
yield String(self, "sectname", 16, strip="\0")
yield String(self, "segname", 16, strip="\0")
yield textHandler(UInt32(self, "addr"), hexadecimal)
yield textHandler(UInt32(self, "size"), hexadecimal)
yield textHandler(UInt32(self, "offset"), hexadecimal)
yield textHandler(UInt32(self, "align"), hexadecimal)
yield textHandler(UInt32(self, "reloff"), hexadecimal)
yield UInt32(self, "nreloc")
yield UInt32(self, "flags")
yield UInt32(self, "reserved1")
yield UInt32(self, "reserved2")
def createFields(self):
yield UInt16(self, "length", "Length of this string")
if self["length"].value:
if self.root.hasUnicodeNames():
yield String(self,
"data",
self["length"].value * 2,
charset="UTF-16-LE")
else:
yield String(self,
"data",
self["length"].value,
charset="ASCII")
def createFields(self):
yield String(self, "signature", 3, "IDv1 signature (\"TAG\")", charset="ASCII")
if self["signature"].value != "TAG":
raise MatchError(
"Stream doesn't look like ID3v1 (wrong signature)!")
# TODO: Charset of below strings?
yield String(self, "song", 30, "Song title", strip=" \0", charset="ISO-8859-1")
yield String(self, "author", 30, "Author", strip=" \0", charset="ISO-8859-1")
yield String(self, "album", 30, "Album title", strip=" \0", charset="ISO-8859-1")
yield String(self, "year", 4, "Year", strip=" \0", charset="ISO-8859-1")
# TODO: Write better algorithm to guess ID3v1 version
version = self.getVersion()
if version in ("v1.1", "v1.1b"):
if version == "v1.1b":
# ID3 v1.1b
yield String(self, "comment", 29, "Comment", strip=" \0", charset="ISO-8859-1")
yield UInt8(self, "track_nb", "Track number")
else:
# ID3 v1.1
yield String(self, "comment", 30, "Comment", strip=" \0", charset="ISO-8859-1")
yield Enum(UInt8(self, "genre", "Genre"), self.GENRE_NAME)
else:
# ID3 v1.0
yield String(self, "comment", 31, "Comment", strip=" \0", charset="ISO-8859-1")
def createFields(self):
iff_start = self.absolute_address
yield String(self,
"endian",
2,
"Endian ('II' or 'MM')",
charset="ASCII")
if self["endian"].value == "II":
self.endian = LITTLE_ENDIAN
else:
self.endian = BIG_ENDIAN
yield UInt16(self, "version", "TIFF version number")
yield UInt32(self, "img_dir_ofs", "Next image directory offset")
yield String(self,
"cr_identifier",
2,
"Canon Raw marker",
charset="ASCII")
yield UInt8(self, "cr_major_version", "Canon Raw major version number")
yield UInt8(self, "cr_minor_version", "Canon Raw minor version number")
yield textHandler(
UInt32(self, "cr_raw_ifd_offset", "Offset to Raw IFD"),
hexadecimal)
offsets = [(self['img_dir_ofs'].value, 'ifd[]', IFD)]
while offsets:
offset, name, klass = offsets.pop(0)
self.seekByte(offset + iff_start // 8, relative=False)
ifd = klass(self, name, iff_start)
yield ifd
for entry in ifd.array('entry'):
tag = entry['tag'].value
if tag in IFD_TAGS:
name, klass = IFD_TAGS[tag]
offsets.append((ifd.getEntryValues(entry)[0].value,
name + '[]', klass))
if ifd['next'].value != 0:
offsets.append((ifd['next'].value, 'ifd[]', IFD))
for ifd in self.array('ifd'):
offs = (off for off, byte in getStrips(ifd))
self.seekByte(min(offs), relative=False)
image = ImageFile(self, "image[]", "Image File", ifd)
yield image
def createFields(self):
yield String(self, "header_id", 4, "Playlist Header Markup (\"mhyp\")", charset="ISO-8859-1")
yield UInt32(self, "header_length", "Header Length")
yield UInt32(self, "entry_length", "Entry Length")
yield UInt32(self, "data_object_child_count", "Number of Child Data Objects")
yield UInt32(self, "playlist_count", "Number of Playlist Items")
yield Enum(UInt8(self, "type", "Normal or master playlist?"), self.is_master_pl_name)
yield UInt8(self, "XXX1", "XXX1")
yield UInt8(self, "XXX2", "XXX2")
yield UInt8(self, "XXX3", "XXX3")
yield TimestampMac32(self, "creation_date", "Date when the playlist was created")
yield UInt64(self, "playlistid", "Persistent Playlist ID")
yield UInt32(self, "unk3", "unk3")
yield UInt16(self, "string_mhod_count", "Number of string MHODs for this playlist")
yield Enum(UInt16(self, "is_podcast", "Playlist or Podcast List?"), self.is_podcast_name)
yield Enum(UInt32(self, "sort_order", "Playlist Sort Order"), self.list_sort_order_name)
padding = self.seekByte(self["header_length"].value, "entry padding")
if padding:
yield padding
for i in range(self["data_object_child_count"].value):
yield DataObject(self, "mhod[]")
for i in range(self["playlist_count"].value):
yield PlaylistItem(self, "playlist_item[]")
def createFields(self):
yield String(self, "name", 32, strip="\0")
yield UInt32(self, "id")
yield UInt32(self, "geometry_mode")
yield UInt32(self, "lighting_mode")
yield UInt32(self, "texture_mode")
yield UInt32(self, "nmesh_vertices")
yield UInt32(self, "ntexture_vertices")
yield UInt32(self, "nfaces")
nb_vert = self["nmesh_vertices"].value
if nb_vert:
yield Vector(self, "vertices",
nb_vert, Vertex, "vertex")
if self["ntexture_vertices"].value:
yield Vector(self, "texture vertices",
self["ntexture_vertices"].value, MapUV, "texture_vertex")
if nb_vert:
yield Vector(self, "light vertices",
nb_vert, Float32, "extra_light")
yield Vector(self, "unknown[]",
nb_vert, Float32, "unknown")
if self["nfaces"].value:
yield Vector(self, "faces", self["nfaces"].value, Face, "face")
if nb_vert:
yield Vector(self, "vertex normals",
nb_vert, Vertex, "normal")
yield UInt32(self, "has_shadow")
yield Float32(self, "unknown[]")
yield Float32(self, "radius")
yield Vertex(self, "unknown[]")
yield Vertex(self, "unknown[]")
def createFields(self):
yield String(self, "name", 32, strip="\0")
yield PaddingBytes(self, "unknown[]", 32, pattern="\xCC")
yield UInt32(self, "flags")
yield UInt32(self, "id")
yield UInt32(self, "type")
yield Int32(self, "mesh_id")
yield UInt32(self, "depth")
yield Int32(self, "parent_offset")
yield UInt32(self, "nchildren")
yield UInt32(self, "first_child_offset")
yield UInt32(self, "next_sibling_offset")
yield Vertex(self, "pivot")
yield Vertex(self, "position")
yield Float32(self, "pitch")
yield Float32(self, "yaw")
yield Float32(self, "roll")
for index in range(4):
yield Vertex(self, "unknown_vertex[]")
if self["parent_offset"].value != 0:
yield UInt32(self, "parent_id")
if self["first_child_offset"].value != 0:
yield UInt32(self, "first_child_id")
if self["next_sibling_offset"].value != 0:
yield UInt32(self, "next_sibling_id")
def createFields(self):
yield String(self, "name", 22, strip='\0')
yield UInt16(self, "sample_count")
yield textHandler(UInt8(self, "fine_tune"), getFineTune)
yield textHandler(UInt8(self, "volume"), getVolume)
yield UInt16(self, "loop_start", "Loop start offset in samples")
yield UInt16(self, "loop_len", "Loop length in samples")
def parseText(self):
yield String(self,
"text",
self["size"].value,
strip=" \0",
truncate="\0",
charset="ISO-8859-1")
